Locking the Digital Front Door: A No-Nonsense Guide to WordPress Security
Our essential checklist to keep unwanted guests out of your business.
Critical PHP Security Vulnerabilities: What Website Owners Need to Know
Two critical security vulnerabilities have been identified in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both could allow attackers to execute malicious code on affected servers, potentially compromising websites, data and server environments.
PHP.net has rated both vulnerabilities as critical, with a CVSS score of 9.2 out of 10.
What’s the issue?
The vulnerabilities affect how PHP handles memory during certain request-processing errors. In simple terms, they can cause PHP to mishandle internal memory, potentially allowing a remote attacker to execute code on the server without logging in.
Because PHP powers WordPress and many other web applications, applying the appropriate security patches is essential. These are vulnerabilities in the underlying PHP runtime, rather than a flaw in WordPress itself.
What does this mean for our hosting clients?
Security fixes have been backported into the existing PHP releases on our hosting platform. This means the underlying PHP build has been patched without changing the version number displayed in cPanel, phpinfo() or WordPress Site Health.
Your displayed PHP version may remain exactly the same, even though the security fix has been applied. This is expected behaviour.
There is no need to change your PHP version or contact us to confirm your site is protected.
Not hosted with us? Check your PHP version
If your website is hosted elsewhere, contact your hosting provider or WordPress developer to confirm that the relevant PHP security patches have been applied. Depending on your server setup, this may involve updating PHP to a patched release or applying a security update to your existing PHP build.
Still running PHP 7? It’s time to review your setup. PHP 7 has reached end of life, meaning it no longer receives official security updates from the PHP project. Continuing to run an unsupported version can leave your website exposed to vulnerabilities that won’t be fixed upstream.
At DCOED, we can help assess your current hosting and PHP configuration, apply available security patches or plan an upgrade to a supported PHP version while checking compatibility with your WordPress site and plugins.
Get in touch with DCOED if you need help securing your website.
Further reading:
